PT-2018-4021 · Gnutls · Mod-Gnutls

Vasyl Kaigorodov · Published 2018-02-03 · Updated 2018-03-13 · CVE-2009-5144

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions mod-gnutls (affected versions not specified)

Description The issue concerns the validation of client certificates. When "GnuTLSClientVerify require" is set in a directory context, mod-gnutls fails to validate client certificates, allowing remote attackers to spoof clients by using a crafted certificate.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-254

Related Identifiers

CVE-2009-5144

Affected Products

Mod-Gnutls

References · 5

• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=578663 · Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=1197127 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-5144 · Security Note
• http://issues.outoforder.cc/view.php?id=93 · Note
• http://openwall.com/lists/oss-security/2015/02/26/6 · Note